<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Runs every registered check and syncs the results into the findings table.
 */
class CGARD_Scanner {

	/**
	 * @return string[] Fully-qualified check class names.
	 */
	private static function get_check_classes() {
		/**
		 * Filter the list of check classes that run on every scan.
		 * Lets Pro (or a future add-on) register additional checks
		 * without touching core scanner code.
		 *
		 * @param string[] $checks
		 */
		return apply_filters(
			'cgard_scan_checks',
			array(
				'CGARD_Check_Core_Version',
				'CGARD_Check_Plugin_Versions',
				'CGARD_Check_File_Permissions',
				'CGARD_Check_Exposed_Files',
				'CGARD_Check_Default_Admin',
			)
		);
	}

	/**
	 * Run all checks and persist the findings. Returns the raw findings array
	 * for anything (e.g. the "Run Scan Now" AJAX handler) that wants it
	 * immediately without a second DB read.
	 *
	 * @return array
	 */
	public static function run() {
		$all_findings = array();

		foreach ( self::get_check_classes() as $class_name ) {
			if ( ! class_exists( $class_name ) ) {
				continue;
			}

			try {
				$check    = new $class_name();
				$findings = $check->run();

				if ( is_array( $findings ) ) {
					$all_findings = array_merge( $all_findings, $findings );
				}
			} catch ( \Throwable $e ) {
				// A single failing check should never take down the whole scan.
				$all_findings[] = array(
					'check_key'   => 'error_' . $class_name,
					'severity'    => 'low',
					'title'       => sprintf( 'Check %s failed to run', $class_name ),
					'description' => $e->getMessage(),
					'fix_steps'   => 'This is a plugin-side error, not a site vulnerability. If it persists, please report it.',
				);
			}
		}

		CGARD_Db::sync_findings( $all_findings );

		return $all_findings;
	}
}